3

I have an environment where we have a GPO which we have set on all profiles to have the setting: Apply local firewall rules: No

I've confirmed that the GP is applied successfully by using gpresult/rsop.

On occasion, a block rule will be added to the system locally by MPSSVC which prevents my customer's application from working. We also have an explicit allow rule for the same process which is added by GPO. We can manually remove the block rule but it eventually comes back.

How is this rule getting added despite having the GPO in place for no local firewall rules?

Improve this question
1
  • I'm not sure, but you may find that turning on the "Windows Defender Firewall: Prohibit Notifications" group policy setting prevents this from happening.
    – Harry Johnston
    Jul 1, 2018 at 1:16

2 Answers 2

Reset to default
2

The documentation says that this settings is used when the user "clicks Allow on the notification message".

It's working as intended, Microsoft never said that the rules created by "something else" will not be applied.

Apply local firewall rules: Yes. We recommend that you allow users to create and use local firewall rules. If you set this to No, then when a user clicks Allow on the notification message to allow traffic for a new program, Windows does not create a new firewall rule and the traffic remains blocked.

Improve this answer
3
  • Thanks for this. I'm a little confused on this part in the document: " If you and the IT staff can create and maintain the list of firewall rules for all permitted applications and deploy them by using GPOs then you can set this value to No." In our case, we are deploying the rules by GPO but I take it that it is still possible that rules may be added by "something else," is that correct?
    – Grant C
    Jul 5, 2018 at 15:54
  • 1
    If you can't manage the firewall rules with a GPO (because you don't want to manage these rules, or if you are in an environment with a lot of exceptions, if each computers needs a different set of rules,...) then you can set this value to Yes, so your users won't be stuck because the local firewall denied the connection
    – Swisstone
    Jul 5, 2018 at 16:45
  • Thank you. This is the behavior I am seeing where UAC will prompt for the rule to be added, the user doesn't get the option to allow/block the application in WinFW. It is blocked automatically.
    – Grant C
    Jul 5, 2018 at 20:22
0

The setting apply local firewall rules yes or no behaves exactly like the title would suggest. It does not matter how a "local" rule appears. If the setting is NO, the LOCAL rule will NOT apply. It is more likely that a second GPO is adding another rule, which then will apply because it is not local.

You can monitor the final ruleset in the monitoring/firewall node on the affected client and see if that is the case.

see also: Deploy Advanced Firewall Rules via GPO - How to avoid merging?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .